WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product software collections✕
Overview 12 matches · 1 in Waratek scope · 1 protected · 2 exploited · 2 CISA KEV · 3 public PoC · 3 EPSS ≥ 0.5
12matches 1in Waratek scope8.3% 1protected8.3% 2exploited16.7% 2CISA KEV16.7% 3public PoC25.0% 3EPSS ≥ 0.525.0%
Protected by Waratek 1 8.3% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 9 75.0% Not applicable 2 16.7% Withdrawn CVE 0 0.0%
Critical 12 100.0% High 0 0.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 8.3% partly blocked 0 0.0% not blocked 11 91.7% not established 0 0.0% unrecorded 0 0.0%
Exploited 2 16.7% Working exploit published 1 8.3% Proof of concept only 0 0.0% Forecast only 1 8.3% No public exploit 8 66.7%
split by peak 5 / quarter
Not applicable: 2Outside Waratek scope: 9Protected by Waratek: 1 Critical: 12 not blocked: 11blocked by ARMR today: 1 No public exploit: 8Forecast only: 1Working exploit published: 1Exploited: 2
Q2 161 Not applicable1 Critical1 not blocked1 No public exploit1 Q3 160 Q4 160 Q1 170 Q2 170 Q3 170 Q4 170 Q1 180 Q2 180 Q3 180 Q4 180 Q1 190 Q2 195 Outside Waratek scope5 Critical5 not blocked5 No public exploit5 Q3 190 Q4 191 Outside Waratek scope1 Critical1 not blocked1 Exploited1 Q1 203 Protected by Waratek1 Outside Waratek scope2 Critical3 blocked by ARMR today1 not blocked2 Working exploit published1 Forecast only1 No public exploit1 Q2 200 Q3 200 Q4 200 Q1 211 Not applicable1 Critical1 not blocked1 No public exploit1 Q2 210 Q3 211 Outside Waratek scope1 Critical1 not blocked1 Exploited1
Q3 16Q1 17Q3 17Q1 18Q3 18Q1 19Q3 19Q1 20Q3 20Q1 21Q3 21
12 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2021-40438 Critical 2021-09-16 Outside Waratek scope Exploited A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
CVE-2019-10196 Critical 2021-03-19 Not applicable No public exploit A flaw was found in http-proxy-agent, prior to version 2.1.0. It was discovered http-proxy-agent passes an auth option to the Buffer constructor without proper sanitization. This could result in a Denial of Service through the usage of all available CPU resources and data exposure through an uninitialized memory leak in setups where an attacker could submit typed input to the auth parameter.
CVE-2014-4650 Critical 2020-02-20 Outside Waratek scope Working exploit published The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read script source code or conduct directory traversal attacks and execute unintended code via a crafted character sequence, as demonstrated by a %2f separator.
CVE-2019-15605 Critical 2020-02-07 Outside Waratek scope Forecast only HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed
CVE-2019-17570 Critical 2020-01-23 Protected by Waratek No public exploit An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpc) library. A malicious XML-RPC server could target a XML-RPC client causing it to execute arbitrary code. Apache XML-RPC is no longer maintained and this issue will not be fixed.
CVE-2019-11043 Critical 2019-10-28 Outside Waratek scope Exploited In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.
CVE-2019-11040 Critical 2019-06-19 Outside Waratek scope No public exploit When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.
CVE-2019-11039 Critical 2019-06-19 Outside Waratek scope No public exploit Function iconv_mime_decode_headers() in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 may perform out-of-buffer read due to integer overflow when parsing MIME headers. This may lead to information disclosure or crash.
CVE-2019-11036 Critical 2019-05-03 Outside Waratek scope No public exploit When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.29, 7.2.x below 7.2.18 and 7.3.x below 7.3.5 can be caused to read past allocated buffer in exif_process_IFD_TAG function. This may lead to information disclosure or crash.
CVE-2019-11035 Critical 2019-04-18 Outside Waratek scope No public exploit When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in exif_iif_add_value function. This may lead to information disclosure or crash.
CVE-2019-11034 Critical 2019-04-18 Outside Waratek scope No public exploit When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in exif_process_IFD_TAG function. This may lead to information disclosure or crash.
CVE-2015-7545 Critical 2016-04-13 Not applicable No public exploit The (1) git-remote-ext and (2) unspecified other remote helper programs in Git before 2.3.10, 2.4.x before 2.4.10, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 do not properly restrict the allowed protocols, which might allow remote attackers to execute arbitrary code via a URL in a (a) .gitmodules file or (b) unknown other sources in a submodule.